P r i m e r o n t h e D a t a P r i v a c y A c t ( D PA ) o f 2 0 1 2

ABCD-S: "Awareness, Breach Management, Compliance, Data

Protection Officer and Security Measures“

NCR – School Registrars’ Association (NACSRA)

November 24, 2017

Dr. Rolando R. Lansigan

Chief, Compliance and Monitoring Division
National Privacy Commission (NPC)
Who stores data about
you?
 SPEED
OF
INFORMATION
Which is more valuable?

Data Money
“Data is more valuable than Money. If
someone takes your money, that's all they
have. If you let someone take your data,
they may eventually take your money too!“
from: Deputy Privacy Commissioner Dondi Mapa
In today’s environment,
where competitors can copy
your products, pirate your
employees, and mirror your
algorithms,
data is the only
sustainable
competitive
advantage.
FORMER
DEPUTY PRIVACY
COMMISSIONER
DAMIAN MAPA
What is the Data Privacy Act of 2012?
• SECTION 1. Short Title. – This Act shall be known as the “Data Privacy Act of 2012”.

• Republic Act 10173, the Data Privacy Act of 2012

AN ACT PROTECTING INDIVIDUAL PERSONAL INFORMATION IN
INFORMATION AND COMMUNICATIONS SYSTEMS IN THE GOVERNMENT AND THE
PRIVATE SECTOR, CREATING FOR THIS PURPOSE A NATIONAL PRIVACY COMMISSION,
AND FOR OTHER PURPOSES

• The National Privacy Commission (NPC) is a body that is mandated to administer and
implement this law. The functions of the NPC include:
– rule-making,
– advisory,
– public education,
– compliance and monitoring,
– investigations and complaints,
– and enforcement.
Main Author of R.A. 10173 and the NPC Commissioners
 Timeline of DPA Law and IRRs passed to
Organization’s Compliance

Sept. 9,
March August Sept. 9,
2012 2016 2016 2016 2017

Data National Implementing IRRs came Comply with

Privacy Privacy rules and into effect registration
Act (DPA) Commission Regulations (compy with requirements
Passed (NPC) was (IRRs) was all
into law formed published provisions
except
Registration Requirements: All personal data processing systems (DPS) registration
operating in the Philippines that involve Personally Identifiable Information (PII) requirments)
concerning at least 1,000 individuals/personal records must be registered with
NPC 12 months
 KEY ROLES IN THE DATA
PRIVACY ACT
• Data Subjects
– Refers to an individual whose, sensitive personal, or privileged information is processed personal

• Personal Information Controller (PIC)

– Controls the processing of personal data, or instructs another to process personal data on its behalf.

• Personal Information Processor (PIP)

– Organization or individual whom a personal information controller may outsource or instruct the processing of personal
data pertaining to a data subject

• Data Protection Officer (DPO)

– Responsible for the overall management of compliance to DPA

• National Privacy Commission

– Independent body mandated to administer and implement the DPA of 2012, and to monitor and ensure compliance of
the country with international standards set for personal data protection
Examples of Breaches and Live Cases
1. COMELeak (1 and 2) 15. Privacy notice
2. BPI – consent form 16. Use of USB
3. Hospital – unsecure storage records 17. Personal laptop stolen
4. Student transferred by her parent without her 18. Lost a CD in transit
knowledge 19. An error in viewing of student records in the
5. Clinical record of a student to disclose with her online system
parents 20. Use of re-cycled papers
6. List of top students/passers 21. Raffle stubs
7. Known Fastfood delivery – disclosing personal info of 22. Universities and Colleges websites with weak
clients authentication
8. No Data sharing agreement (DSA) between and 23. Personal Records stolen from home of an
among Schools and Universities employee
9. Cedula in malls 24. Photocopiers re-sold without wiping the hard
10. Security issues in buildings – logbook drives
11. Profiling of customers from a mall 25. Release of CCTV Footage
12. Unjustifiable collection of personal data of a school 26. Hard drives sold online
13. No Privacy Notice 27. Password hacked/revealed
14. Use of USB 28. Unencrypted Data
 Potential Penalties listed in the Data Privacy Act
DPA Punishable Act For Personal For Sensitive Personal Fine (Pesos)
Section Information Information

JAIL TERM
25 Unauthorized processing 1-3 years 3-6 years 500 k – 4 million

26 Access due to negligence 1-3 years 3-6 years 500 k – 4 million

27 Improper disposal 6 months – 2 years 3-6 years 100 k – 1 million

28 Unauthorized purposes 18 months – 5 years 2-7 years 500 k – 2 million

29 Intentional breach 1-3 years 500 k – 2 million

30 Concealment of breach 18 months – 5 years 500 k – 1 million

31 Malicious disclosure 18 month – 5 years 500 k – 1 million

32 Unauthorized disclosure 1-3 years 3-5 years 500 k – 2 million

33 Combination of acts 1-3 years 1 million – 5 million

Top 20 Government-imposed Data Privacy Fines
W orldwide, 1999-2014 **
Amount of
Privacy principles
Rank Fined entity fines Year Country
violated
and penalties

1 Apple $32.5M 2014 U.S. Choice and Consent

2 Google $22.5M 2012 U.S. Collection
3 Google $17M 2013 U.S. Collection and Notice
4 ChoicePoint $15M 2006 U.S. Security
5 Hewlitt-Packard $14,5M 2006 U.S. Collection
6 LifeLock $12M 2010 U.S. Accuracy, Security
7 TJ Maxx $9.8M 2009 U.S. Security
8 Dish Network $6M 2009 U.S. Choice and Consent
9 DirecTV $5.3M 2005 U.S. Choice and Consent
10 HSBC $5M 2009 UK Security
1999-
11 US Bancorp $5M U.S. Disclosure
2000
12 Craftmatic $4.3 2007 U.S. Choice and Consent
13 Cignet Health $4.3M 2011 U.S. Access
14 Barclays Bank $3.8M 2013 U.S. Use and Retention
15 Certegy Check Services $3.5M 2013 U.S. Accuracy
16 Playdom $3M 2011 U.S. Collection and Notice
17 The Broadcast Team $2.8M 2007 U.S. Collection
Equifax, TransUnion and
18 $2.5M 2000 U.S. Access
Experian
19 CVS Caremark $2.3M 2009 U.S. Security and Disposal
20 Norwich Union Life $1.8M 2007 UK Disclosure

**SOURCE IAPP 17 FEB 2014

 Rights of the Data Subject
• Right to be informed - IRR, Section 34.a
• Right to object - IRR, Section 34.b
• Right to access - IRR, Section 34.c
• Right to data portability - IRR, Section 36
• Right to correct (rectification) - IRR, Section 34.d
• Right to erasure or blocking - IRR, Section 34.e
• Right to file a complaint - IRR, Section 34.a.2
• Right to damages - IRR, Section 34.f
• Transmissibility of Rights - IRR, Section 35
CLASSIFICATION OF PERSONAL DATA

Personal Information:
Personal information refers to any
information whether recorded in a material
form or not, from which the
• identity of an individual is apparent or
can be reasonably and directly
ascertained by the entity holding the
information, or
• when put together with other
information would directly and certainly
identify an individual.
Sensitive Personal Information.
Refers to personal information about an
individual’s:
race, ethnic origin, marital status,
age, color, religious, philosophical or
political affiliations, health, education,
genetics, sexual life, any proceeding for
any offense committed or alleged to
have been committed, the disposal of
such proceedings, the sentence of any
court in such proceedings;

Also includes information issued by government

agencies peculiar to an individual which includes,
but not limited to:
social security numbers, previous or
current health records, licenses or its
denials, suspension or revocation, and tax
returns;
and specifically established by an executive order
or an act of Congress to be kept classified.
Personal Data Lifecycle
Acquisitio
Storage USE
n

• Key considerations when listing your

personal data:
Destructio – What personal data do you collect?
Transfer
n – In what form and through which channels?
– For what purpose you collect personal data
– How is it used?
– Who is this data shared with internally and
externally?
Retention/Disposal should be – Who is authorized to access this data?
based on: – Where do you keep your data?
– How long do you keep your data?
1. Law – How do you dispose this data?
2. Industry Best Practice
3. Business Needs
 TRANSPARENCY – “the CONSENT Regime”

Principle of Transparency
A data subject must be aware of the nature, purpose, and extent of the
processing of his or her personal data, including the risks and safeguards
involved, the identity of personal information controller, his or her rights as a
data subject, and how these can be exercised. Any information and
communication relating to the processing of personal data should be easy to
access and understand, using clear and plain language.
LEGITIMATE PURPOSE

Principle of Legitimate Purpose

The processing of information shall be
compatible with a declared and
specified purpose, which must not be
contrary to law, morals, or public
policy.
 PROPORTIONALITY

Principle of Proportionality
The processing of information shall be adequate, relevant, suitable,
necessary, and not excessive in relation to a declared and specified
purpose. Personal data shall be processed only if the purpose of the
processing could not reasonably be fulfilled by other means.

Avoid this mentality:

“just in case we need it”
“this is what we always do”
THE
FIVE
PILLARS
OF
COMPLIANCE
Commit to Know Your Risk:
Be Accountable:
Comply: Appoint Conduct a
Create your
a Data Privacy Impact
Privacy
Protection Assessment
Management
Officer (DPO) (PIA)
Program and
Privacy Manual
 Be Prepared for
Demonstrate Breach:
Your Compliance: Regularly
Implement your exercise your
privacy and Breach
data protection Reporting
(PDP) measures. Procedures
(BRP).
 Sharing
Other Agreement
Privacy notice
Require (DSA), if
applicable  What information is being

ments • Sub- collected?

• Annual contracting  Who is collecting it?

Breach Drill Agreement /  How is it collected?

 Notification to Outsourcing  Why is it being collected?

NPC within 72 Agreement
hours  How will it be used?

 (in the event of a

 Who will it be shared with?
personal data
breach)

• Annual
Breach
Report
• Security
Clearance
• Privacy
Notice
• Data
 The Data Privacy Principles
• Personal data shall be:
1. processed fairly and lawfully
2. processed only for specified, lawful and compatible
purposes
3. adequate, relevant and not excessive
4. accurate and up to date
5. kept for no longer than necessary
6. processed in accordance with the rights of data
subjects
7. kept secure
8. shared to other PICs only if there is a DSA.
 Self-help checklist on data protection policy
Remember: you should be able to answer YES to all of the questions below. If you can, your business is in good shape from a data
protection viewpoint. If you don't have a clean sheet, the checklist can help you identify the areas where you need to improve.

Rule 1: Fair obtaining: Rule 2: Purpose specification

• At the time when we collect information about
individuals, are they made aware of the uses
for that information?
• Are people made aware of any disclosures of
their data to third parties?
• Have we obtained people's consent for any
secondary uses of their personal data, which
might not be obvious to them
• Can we describe our data-collection practices
as open, transparent and up-front?
• Are we clear about the purpose (or purposes)
for which we keep personal information?
• Are the individuals on our database also clear
about this purpose?
• If we are required to register with NPC, does
our register entry include a proper,
comprehensive statement of our
purpose? [Remember, if you are using personal data
for a purpose not listed on your register entry, you
may be committing an offence.]
• Has responsibility been assigned for
maintaining a list of all data sets and the
purpose associated with each?
 Self-help checklist on data protection policy
Remember: you should be able to answer YES to all of the questions below. If you can, your business is in good shape from a data
protection viewpoint. If you don't have a clean sheet, the checklist can help you identify the areas where you need to improve.

Rule 3: Use and disclosure of information Rule 4: Security

• Are there defined rules about the use and
disclosure of information?
• Are all staff aware of these rules?
• Are the individuals aware of the uses and
disclosures of their personal data? Would they
be surprised if they learned about them?
Consider whether the consent of the
individuals should be obtained for these uses
and disclosures.
• If we are required to register with NPC, does
our register entry include a full list of persons
to whom we may need to disclose personal
data? [Remember, if you disclose personal data
to someone not listed on your register entry, you
may be committing an offence.]
• Is there a list of security provisions in place for
each data set?
• Is someone responsible for the development
and review of these provisions?
• Are these provisions appropriate to the
sensitivity of the personal data we keep?
• Are our computers and our databases
password-protected, and encrypted if
appropriate?
• Are our computers, servers, and files securely
locked away from unauthorized people?
 Self-help checklist on data protection policy
Remember: you should be able to answer YES to all of the questions below. If you can, your business is in good shape from a data
protection viewpoint. If you don't have a clean sheet, the checklist can help you identify the areas where you need to improve.

Rule 5: Adequate, relevant and not Rule 6: Accurate and up-to-date

excessive • Do we check our data for accuracy?
• Do we collect all the information we • Do we know how much of our personal
need to serve our purpose effectively, data is time-sensitive, i.e. likely to
and to deal with individuals in a fair become inaccurate over time unless it
and comprehensive manner? is updated?
• Have we checked to make sure that all • Do we take steps to ensure our
the information we collect is relevant, databases are kept up-to-date?
and not excessive, for our specified
purpose?
• If an individual asked us to justify every
piece of information we hold about him
or her, could we do so?
• Does a policy exist in this regard?
 Self-help checklist on data protection policy
Remember: you should be able to answer YES to all of the questions below. If you can, your business is in good shape from a data
protection viewpoint. If you don't have a clean sheet, the checklist can help you identify the areas where you need to improve.

Rule 7: Retention time

• Is there a clear statement on how long Rule 8: The Right of Access
personal data are to be retained? • Is a named individual responsible for
• Are we clear about any legal handling access requests?
requirements on us to retain data for a • Are there clear procedures in place for
certain period? dealing with such requests?
• Do we regularly purge our databases • Do these procedures guarantee
of data which we no longer need, such compliance with the RA 10173
as data relating to former customers or requirements?
staff members?
• Do we have a policy on deleting
personal data as soon as the purpose
for which we obtained the data has
been completed?
 Self-help checklist on data protection policy
Remember: you should be able to answer YES to all of the questions below. If you can, your business is in good shape from a data
protection viewpoint. If you don't have a clean sheet, the checklist can help you identify the areas where you need to improve.

Registration Training & Education

• Are we clear about whether or not we
need to be registered with the NPC?
• If registration is required, is the
registration kept up to date? Does the
registration accurately reflect our
practices for handling personal
data? [Remember, if your data-handling practices
are out of line with the details set out in your register
entry, you may be committing an offence.]
• Do we know about the levels of
awareness of data protection in our
organization?
• Are our staff aware of their data
protection responsibilities - including
the need for confidentiality?
• Is data protection included as part of
the training program for our staff?
 Self-help checklist on data protection policy
Remember: you should be able to answer YES to all of the questions below. If you can, your business is in good shape from a data
protection viewpoint. If you don't have a clean sheet, the checklist can help you identify the areas where you need to improve.

Co-ordination and Compliance

Other Requirements
• Has a Data Protection Officer (DPO) /
Compliance Officer for Privacy (COP) • Annual Breach Drill
been appointed? – Notification to NPC within 72
• Are all staff aware of his or her role? hours (in the event of a personal data breach)
• Are there mechanisms in place for • Annual Breach Report
formal review by DPO activities within • Security Clearance
our organization? • Privacy Notice
• Is the Privacy Impact Assessment • Data Sharing Agreement (DSA), if
(PIA) carefully planned and executed applicable
according to its purpose? • Sub-contracting Agreement /
• Is there a Breach Management Outsourcing Agreement
Program (BMP) in place?
1 Technical

2 Organisational – other
measures
Technical

Encryption Backups
To what standard? (cost Vs benefit) Secure: encrypted tapes | cloud-provider

All devices or just some? Auditable process

Passwords Access control

Enforced strength and updates?
Who decides permissions and privileges (‘need to
know’)?
Sharing data
Technical solutions – e.g. via email; portals
Remote access
How delivered securely?
System testing & maintenance
Permit Bring Your Own Device?
Who has access, to what (System Administrators)

Live or dummy data? Firewalls / Anti-virus / Spam filters

Organisational – physical security

Secure Office Storage Remote working

For removable devices and hardcopy information Secure both hardcopies and devices when in
transit.

Kept out of sight: in transit | at home.

Identifying marks? Locked print?

Kensington locks? Offsite? Lockable pedestals | Kensington locks?

Building access control Secure disposal

Secure premises – CCTV | locked windows | perimeter
Shredding of hardcopies

Locked CCTV room | server room

Beyond use | Reuse | Resale

ID badges, supervised visitors | contractors
Organisational – other measures

Policy, procedures, guidance & training

Eliminate ambiguities Clearly communicated, readily accessible and understood

Procurement (and contracts)

Human Resources
i.e. outsourced services like IT and software
Explicit roles and responsibilities in Job
Descriptions and Terms of Reference
Due diligence

Terms and Conditions: confidentiality clauses

Compliant contract Terms and Conditions:
• Act on your instructions
Clear expectations | reporting lines • Equivalent security

Disciplinary process Training records Auditing and monitoring

 Other Security Measures
• Shredding all confidential waste.
• Using strong passwords.
• Installing a firewall and virus checker on your computers.
• Encrypting any personal information held electronically.
• Disabling any ‘auto-complete’ settings.
• Holding telephone calls in private areas.
• Checking the security of storage systems.
• Keeping devices under lock and key when not in use.
• Not leaving papers and devices lying around.
12 offline measures to keep your physical data secure
• Lock rooms containing confidential information when not in use.
• Make sure employees don’t write their passwords down.
• Use swipe cards or keypads to access the office.
• Use CCTV cameras to monitor your office space.
• Shield keyboards when inputting passwords.
• Shred confidential waste.
• Use forensic property marking equipment and spray systems to mark assets.
• Use anti-climb paint on exterior walls and drains.
• Install an alarm system.
• Place bars on ground floor windows.
• Hide valuable equipment from view when not in the office.
• Assign a limited number of trustworthy employees as key safe holders.
 Holding Data and Keeping it Up-to-Date
• Carry out an information audit at least annually.
– Write a letter at the start of each school year asking parents and students to
check that their details are correct. This also helps prevent emergency risks, e.g.
if an old address or phone number is on record.
– Check that ‘live’ files are accurate and up to date.
– Any time you become aware that information needs amending, do so
immediately
– Any personal data that is out of date or no longer needed should be ‘destroyed’.
This may involve shredding documents or deleting computer files securely so
that they cannot be retrieved.
– Schools must follow the disposal of records schedule. This schedule states how
long certain types of personal data can be held for until it must be destroyed.
Some stipulations are legal obligations while others are best practice.

You are violating the Data Privacy Act if you keep any data for longer than it is needed.
Designating a DPO is the first essential
step. You cannot register with the NPC
unless you have a DPO.
 General Qualifications
• The Data Protection Officer (DPO) should possess specialized
knowledge and demonstrate reliability necessary for the
performance of his or her duties and responsibilities. As such, the
DPO should have expertise in relevant privacy or data protection
policies and practices. He or she should have sufficient
understanding of the processing operations being carried out by the
Personal Information Controller (PIC) or the Personal Information
Processor (PIP), including the latter’s information systems, data
security and/or data protection needs.

• Knowledge by the DPO of the sector or field of the PIC or PIP, and
the latter’s internal structure, policies, and processes is also useful.

• The minimum qualifications for a DPO shall be proportionate to his

or her functions.
Duties and Responsibilities Of the DPO
a. monitor the PIC’s or PIP’s compliance with the DPA, its
IRR, issuances by the NPC and other applicable laws
and policies. For this purpose, he or she may:
1. collect information to identify the processing operations, activities,
measures, projects, programs, or systems of the PIC or PIP, and
maintain a record thereof;
2. analyze and check the compliance of processing activities,
including the issuance of security clearances to and compliance
by third-party service providers;
3. inform, advise, and issue recommendations to the PIC or PIP;
4. ascertain renewal of accreditations or certifications necessary to
maintain the required standards in personal data processing; and
5. advice the PIP or PIP as regards the necessity of executing a
Data Sharing Agreement with third parties, and ensure its
compliance with the law;
b. ensure the conduct of Privacy Impact Assessments
relative to activities, measures, projects, programs, or
systems of the PIC or PIP;
c. advice the PIC or PIP regarding complaints and/or the
exercise by data subjects of their rights (e.g., requests
for information, clarifications, rectification or deletion of
personal data);
d. ensure proper data breach and security incident
management by the PIC or PIP, including the latter’s
preparation and submission to the NPC of reports and
other documentation concerning security incidents or
data breaches within the prescribed period;
e. inform and cultivate awareness on privacy and data
protection within the organization of the PIC or PIP,
including all relevant laws, rules and regulations and
issuances of the NPC;
f. advocate for the development, review and/or
revision of policies, guidelines, projects and/or
programs of the PIC or PIP relating to privacy and
data protection, by adopting a privacy by design
approach;
g. serve as the contact person of the PIC or PIP vis-à-
vis data subjects, the NPC and other authorities in
all matters concerning data privacy or security
issues or concerns and the PIC or PIP;
h. cooperate, coordinate and seek advice of the NPC
regarding matters concerning data privacy and
security; and
i. perform other duties and tasks that may be
assigned by the PIC or PIP that will further the
interest of data privacy and security and uphold the
rights of the data subjects.
Additional functions of a Data Protection Officer (DPO):

1. ensuring that controllers and data subjects are informed of

their rights and obligations;
2. ensuring in an independent manner the internal application of
the Regulation;
3. carrying out inquiries where necessary;
4. keeping a register of the processing operations carried out by
the controller;
5. notifying the NPC of processing operations which may present
specific risks;
6. responding to requests from NPC and cooperating with NPC
What support is needed from the rest of the org’n?
What support is needed from the rest of the org’n?
What support is needed from the rest of the org’n?
What support is needed from the rest of the org’n?
What support is needed from the rest of the org’n?
In Closing: How the NPC can help

Help in delivering -Generic

the message to guidance and
top management frameworks
(www.privacy.gov.ph)

-Updates on new -When requested,

standards and/or advice on specific
circulars matters
(www.privacy.gov.ph) (info@privacy.gov.ph)
Thank you! Any questions?
info@privacy.gov.ph